Cloud Digital Leader Fundamental Cloud Concepts Practice Question
A healthcare organization must store patient health records (PHI) in the cloud and comply with HIPAA. They need to ensure data is encrypted at rest by default, maintain access logs, and restrict access to authorized personnel. Which THREE Google Cloud features or services should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Audit Logs
HIPAA requires encryption at rest (Cloud KMS provides managed keys), audit logs (Cloud Audit Logs), and access control (IAM). Cloud NAT provides outbound internet access, VPC Flow Logs capture network metadata, not access logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cloud Audit Logs
Why this is correct
Cloud Audit Logs are the definitive record of 'who did what, where, and when' in Google Cloud. For HIPAA-covered entities, enabling Data Access audit logs is mandatory to capture every read, write, and deletion of patient records, providing the auditable trail required by the Security Rule. Admin Activity logs track configuration changes, and System Event logs record system-level actions, all of which support security monitoring and incident forensics.
- ✓
Identity and Access Management (IAM)
Why this is correct
Cloud IAM controls who is authenticated and authorized to interact with PHI-storing resources like Cloud Storage buckets or BigQuery datasets. By assigning fine-grained roles (e.g., storage.objectViewer vs. storage.admin) and applying conditions such as IP-address or scheduled-time restrictions, organizations enforce least privilege and separation of duties. This directly supports HIPAA's Access Control standard by limiting exposure to patient data only to authorized personnel.
- ✗
VPC Flow Logs
Why it's wrong here
VPC Flow Logs capture network-level metadata such as source/destination IP addresses, ports, and protocol, but they cannot identify a specific user or whether they accessed a particular patient record. While useful for detecting anomalous network traffic or investigating network-layer attacks, they do not satisfy HIPAA's audit control requirement because they lack the user-identity and resource-access context found in Cloud Audit Logs.
- ✗
Cloud NAT
Why it's wrong here
Cloud NAT is a networking service that enables outbound internet connections from private instances without assigning them public IP addresses. It does not perform encryption, manage cryptographic keys, or enforce access control on PHI, so it is irrelevant to HIPAA's technical safeguards. Its function is purely address translation and has no bearing on confidentiality, integrity, or availability of patient data.
- ✓
Cloud Key Management Service (Cloud KMS)
Why this is correct
Cloud KMS is the centralized key management service for encrypting data at rest in Google Cloud. HIPAA requires encryption of ePHI, and Cloud KMS lets you create, rotate, and destroy keys while controlling access to those keys via IAM roles. It integrates with services like Cloud Storage and BigQuery, ensuring that even if underlying storage is compromised, patient data remains unreadable without the proper keys.
Visual reference
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Cloud Audit Logs
Cloud Audit Logs are a record of actions taken by users, services, and resources inside a cloud environment, capturing who did what, when, and from where.
Key term
VPC
A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you can launch and manage resources like servers and databases with complete control over IP addressing, subnets, route tables, and security.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.